Fluent Essays

1075 Volume 69 April 2017 Stanford Law Review ARTICLE Searching Places Unknown: Law Enforcement Jurisdiction on the Dark Web Ahmed Ghappour* Abstract. The use of hacking tools by law enforcement to pursue criminal suspects who have anonymized their communications on the dark web presents a looming flashpoint between criminal procedure and international law. Criminal actors who use the dark web (for instance, to commit crimes or to evade authorities) obscure digital footprints left behind with third parties, rendering existing surveillance methods obsolete. In response, law enforcement has implemented hacking techniques that deploy surveillance software over the Internet to directly access and control criminals’ devices. The practical reality of the underlying technologies makes it inevitable that foreign-located computers will be subject to remote “searches” and “seizures.” The result may well be the greatest extraterritorial expansion of enforcement jurisdiction in U.S. law enforcement history. This Article examines how the government’s use of hacking tools on the dark web profoundly disrupts the legal architecture on which cross-border criminal investigations rest. These overseas cyberoperations raise increasingly difficult questions regarding who may authorize these activities, where they may be deployed, and against whom they may lawfully be executed. The rules of criminal procedure fail to regulate law enforcement hacking because they allow these critical decisions to be made by rank-and-file officials despite potentially disruptive foreign relations implications. This Article outlines a regulatory framework that reallocates decisionmaking to the institutional actors who are best suited to determine U.S. foreign policy and avoids sacrificing law enforcement’s ability to identify and locate criminal suspects who have taken cover on the dark web. * Visiting Assistant Professor, U.C. Hastings College of the Law. For helpful conversations, comments, and support, I thank Ryan Calo, Anupam Chander, Bobby Chesney, Danielle Citron, Jennifer Daskal, Bill Dodge, Scott Dodson, Derek Jinks, Elizabeth Joh, Orin Kerr, Rick Marcus, Tara Mikkilineni, Paul Ohm, Austen Parrish, Stephanie K. Pell, Morris Ratner, Bertrall Ross, Reuel Schiller, Chris Soghoian, David Sloss, and Katherine Strandburg. I also thank participants in workshops and conferences at American University Washington College of Law, U.C. Berkeley School of Law, U.C. Davis School of Law, U.C. Hastings College of the Law, N.Y.U. School of Law, the U.S. Military Academy, and Yale Law School for their helpful comments and conversations. Finally, I thank the editors of the Stanford Law Review for their terrific editing. Searching Places Unknown 69 STAN. L. REV. 1075 (2017) 1076 Table of Contents Introduction .......................................................................................................................................................... 1077 I. Law Enforcement in the Dark ......................................................................................................... 1087 A. The Dark Web ................................................................................................................................ 1087 B. Failure of Conventional Surveillance Methods........................................................... 1090 C. Hacking as an Investigative Tool on the Dark Web ................................................. 1095 II. Law Enforcement out of Bounds .................................................................................................... 1099 A. Conventional Methods Are in Harmony with International Law ................... 1099 B. Failure of the Existing Rules .................................................................................................. 1106 C. The Foreign Relations Risk of Hacking the Dark Web .......................................... 1108 1. The risk of attribution ..................................................................................................... 1108 2. The risk of vulnerability disclosure ......................................................................... 1110 3. The risk to diplomatic legitimacy ............................................................................. 1112 4. The risk of foreign prosecution.................................................................................. 1115 5. The risk of countermeasures ........................................................................................ 1116 III. Toward a Normative Legal Process .............................................................................................. 1122 A. Failure of the Existing Legal Process ................................................................................. 1123 B. Substantive Policy Preferences .............................................................................................. 1128 1. What hacking techniques should be authorized? ............................................. 1128 2. Who should be targeted? ................................................................................................ 1130 3. What crimes should trigger use of hacking techniques? .............................. 1130 C. Implementation and Enforcement ...................................................................................... 1132 Conclusion ............................................................................................................................................................. 1135 Searching Places Unknown 69 STAN. L. REV. 1075 (2017) 1077 Introduction Nestled deep beneath the surface of the World Wide Web, Dread Pirate Roberts (DPR) ran an underground empire of criminality. Not much was known about DPR, except that he appeared to have built the Silk Road—a global online marketplace for illicit services and contraband.1 DPR—later identified as Ross Ulbricht—was the target of a global manhunt that operated in the dark for nearly three years.2 In that time, the Silk Road attracted over 100,000 users who transacted over one million deals, generating an estimated $1.2 billion in global sales from vendors located in more than ten countries around the world.3 The Silk Road was built to facilitate black market transactions. It was hosted on the dark web, a global network of computers that use a cryptograph- ic protocol to communicate, enabling users to conduct transactions anonymously without revealing their location.4 Users could only make payments in the digital currency Bitcoin, and transactions were run through a “series of dummy transaction[s] to disguise the link between buyers and 1. MARC GOODMAN, FUTURE CRIMES: EVERYTHING IS CONNECTED, EVERYONE IS VULNERABLE, AND WHAT WE CAN DO ABOUT IT 194 (2015); Press Release, U.S. Att’y’s Office for the S. Dist. of N.Y., U.S. Dep’t of Justice, Ross Ulbricht, A/K/A “Dread Pirate Roberts,” Sentenced in Manhattan Federal Court to Life in Prison (May 29, 2015), https://www.justice.gov/usao-sdny/pr/ross-ulbricht-aka-dread-pirate-roberts -sentenced-manhattan-federal-court-life-prison. 2. The Silk Road website went live in February 2011. See GOODMAN, supra note 1, at 198. U.S. agencies commenced a number of independent Silk Road investigations in the fall of 2011. See, e.g., Transcript of Trial at 1389, United States v. Ulbricht, No. 14 Cr. 68 (KBF) (S.D.N.Y. Jan. 28, 2015) (relating a joint stipulation by the government and defense that if called to testify, Special Agent Richardson of the Drug Enforcement Administration would testify that she attempted a number of purchases on the Silk Road website between September 2011 and May 2013 as part of an undercover investigation); Transcript of Trial at 71, 153, Ulbricht, No. 14 Cr. 68 (KBF) (S.D.N.Y. Jan. 14, 2015) (indicating via in-court testimony that the U.S. Department of Homeland Security (DHS) commenced its investigation in October 2011); Affidavit of Special Agent Ilhwan Yum in Support of a Search Warrant at 1, 6, United States v. Certain Premises, No. 13-1051-M (E.D. Pa. Sept. 9, 2013) (stating that an investigation by the Federal Bureau of Investigation (FBI) was ongoing as of November 2011). Ulbricht was arrested on October 1, 2013. See Affidavit of Special Agent Tigran Gambaryan in Support of Criminal Complaint at 11, United States v. Force, No. 3-15-70370 (N.D. Cal. Mar. 25, 2015). The Silk Road was shuttered by the FBI on October 2, 2013. See id. at 10. 3. See Press Release, U.S. Att’y’s Office for the S. Dist. of N.Y., supra note 1; see also Donna Leinwand Leger, How FBI Brought Down Cyber-Underworld Site Silk Road, USA TODAY (May 15, 2014, 2:54 PM EDT), http://usat.ly/1b8Gntk (“Beyond illegal drugs, the site served as a bazaar for fake passports, driver’s licenses and other documents, as well as illegal service providers, such as hit men, forgers and computer hackers.”). 4. Leger, supra note 3. To access the Silk Road, users needed specialized anonymity software allowing them to communicate on the dark web. Id. Searching Places Unknown 69 STAN. L. REV. 1075 (2017) 1078 sellers.”5 Thousands of drug dealers flocked to the Silk Road because of the anonymity it promised;6 there, they conducted over a million drug deals out of reach of law enforcement’s most advanced electronic surveillance tools.7 Investigators made bold efforts to infiltrate the hidden website to identify DPR. They posed as buyers and sellers on the site, completing over a hundred purchases.8 One agent even infiltrated the staff of the website, spending ten to twelve hours per day administering the site and communicating with DPR directly.9 All for naught. Their attempts failed because existing surveillance methods rely on digital trails left behind with third parties by computers on the web—the very information obscured by the dark web. In the end, it was an IRS agent who solved the case, stumbling upon communications on a public website advertising the Silk Road just before its launch in 2011.10 Because of Ulbricht’s own human error, the communication was traced back to him,11 and the alleged kingpin was apprehended, prosecuted, and sentenced to life in prison.12 Several underground marketplaces surfaced in the wake of the Silk Road,13 highlighting an asymmetry between investigators’ ability to track unlawful activity and criminals’ capacity to commit crimes on the dark web.14 The 5. Id. 6. See Transcript of Trial at 42, Ulbricht, No. 14 Cr. 68 (KBF) (S.D.N.Y. Jan. 13, 2015) (“Thousands of drug dealers flocked to Silk Road, and more than 1 million drug deals took place on the site before the government shut it down.”). 7. See id.; Leslie R. Caldwell, Ensuring Tech-Savvy Criminals Do Not Have Immunity from Investigation, U.S. DEP’T JUST. BLOGS (Nov. 21, 2016), https://www.justice.gov/ opa/blog/ensuring-tech-savvy-criminals-do-not-have-immunity-investigation (“[T]he abuse of internet anonymizing technology . . . [is] the digital equivalent of crimes committed in the middle of a busy street, in full view of the citizenry and the police, with little risk of being caught.” (italics omitted)). 8. See GOODMAN, supra note 1, at 196. 9. See Andy Greenberg, Undercover Agent Reveals How He Helped the FBI Trap Silk Road’s Ross Ulbricht, WIRED (Jan. 14, 2015, 6:34 PM), https://www.wired.com/2015/01/silk -road-trial-undercover-dhs-fbi-trap-ross-ulbricht. 10. See Nathaniel Popper, The Tax Sleuth Who Took Down a Drug Lord, N.Y. TIMES: DEALBOOK (Dec. 25, 2015), http://nyti.ms/1R02DMZ. 11. See id. 12. See Transcript of Sentencing at 94, Ulbricht, No. 14 Cr. 68 (KBF) (S.D.N.Y. May 29, 2015). In the interest of disclosure, the Author advised on Ulbricht’s appeal. 13. See, e.g., Steven Nelson, Buying Drugs Online Remains Easy, 2 Years After FBI Killed Silk Road, U.S. NEWS & WORLD REP. (Oct. 2, 2015, 3:12 PM), http://www.usnews.com/ news/articles/2015/10/02/buying-drugs-online-remains-easy-2-years-after-fbi-killed -silk-road; Benjamin Weiser, Man Charged with Operating Silk Road 2.0, a Black Market Website, N.Y. TIMES (Nov. 6, 2014), http://nyti.ms/1slvgVH. 14. For example, Senator Tom Carper (D-Del.), then-Chairman of the Senate Homeland Security and Governmental Affairs Committee, stated at the time of the launch of Silk Road 2.0: “This new website—launched barely a month after Federal agents shut down footnote continued on next page Searching Places Unknown 69 STAN. L. REV. 1075 (2017) 1079 existence of hidden services like the Silk Road “dramatically lower[s] the entry barriers into the underground economy—for both buyers and sellers” of illicit goods and services.15 The use of the dark web by criminal actors therefore enables secret, untraceable criminal activity to take place at scale. This has led policymakers to question whether law enforcement has sufficient tools to counter the illicit conduct that might flow through the digital underworld.16 The term “network investigative technique” is a euphemism for law enforcement hacking; it describes a law enforcement surveillance method that entails remotely accessing and installing malware on a computer without the permission of its owner or operator.17 Network investigative techniques are especially useful in the pursuit of criminal suspects who use anonymizing software to obscure their location. By accessing the target computer directly and converting it into a surveillance device, use of network investigative techniques circumvents the need to know a target’s location and makes the the original Silk Road—underscores the inescapable reality that technology is dynamic and ever-evolving and that government policy needs to adapt accordingly.” Press Release, Sen. Tom Carper, Chairman, Senate Homeland Sec. & Governmental Affairs Comm., Chairman Carper Statement on the Unveiling of the So-Called “Silk Road 2.0” Website (Nov. 6 2013), https://www.hsgac.senate.gov/media/majority-media/ chairman-carper-statement-on-the-unveiling-of-the-so-called-silk-road-20-website. 15. See Government Sentencing Submission at 2, Ulbricht, No. 14 Cr. 68 (KBF) (S.D.N.Y. May 26, 2015). 16. See, e.g., Press Release, Sen. Tom Carper, supra note 14. 17. This Article uses the terms “network investigative technique,” “cyberexfiltration operation,” and “hacking” interchangeably to describe the use of software that subverts a computer. In computer science, the common term is “malware” (short for “malicious software”). See ROBERT SLADE, DICTIONARY OF INFORMATION SECURITY 118 (2006) (defining malware as a “collective term including the many varieties of deliberately malicious software; that is, software written for the purpose of causing inconvenience, destruction, or the breaking of security policies or provisions”). Law enforcement has used a wide variety of other terms to refer to hacking, including “Computer and Internet Protocol Address Verifier” (CIPAV), “Internet Protocol Address Verifier” (IPAV), “Remote Access Search and Surveillance” (RASS), “Remote Computer Search,” “Remote Search,” “Computer Tracer,” “Internet Tracer,” “Remote Computer Trace,” and “Web Bug.” See, e.g., Application & Affidavit of Special Agent Norman B. Sanders, Jr. for Search Warrant at 2-3, In re Search of Any Comput. Accessing Elec. Messages Directed to MySpace Account “Timberlinebombinfo,” No. MJ07-5114 (W.D. Wash. June 12, 2007) [hereinafter Sanders Affidavit] (using “CIPAV”); see also Elec. Frontier Found., FBI CIPAV-8 (n.d.), https://www.eff.org/files/filenode/cipav/fbi_cipav-08.pdf (consisting of a cache of documents released from the FBI to the Electronic Frontier Foundation showing usage of the terms “CIPAV,” “IPAV,” “RASS,” and “Web Bug” in various FBI correspondences and field office requests for technical assistance from the FBI’s Cryptologic and Electronic Analysis Unit); Elec. Frontier Found., FBI CIPAV-10 (n.d.), https://www.eff.org/files/filenode/cipav/FBI_CIPAV-10.pdf (consisting of a cache of documents released from the FBI to the Electronic Frontier Foundation showing usage of these terms in various FBI field office requests for technical assistance from the FBI’s Cryptologic and Electronic Analysis Unit). Searching Places Unknown 69 STAN. L. REV. 1075 (2017) 1080 new surveillance method a practical solution for the pursuit of criminal suspects on the dark web. Once installed, the right malware can cause a computer to perform any task the computer is capable of performing.18 Malware can force the target computer to covertly upload files to a server controlled by law enforcement or instruct the computer’s camera or microphone to gather images and sound.19 It can even commandeer computers that associate with the target by, for example, accessing a website it hosts.20 The legal process for the use of network investigative techniques is governed by Federal Rule of Criminal Procedure 41, which articulates procedures for obtaining a search warrant in federal magistrate court. The former version of Rule 41 restricted authority to issue search warrants to the district of the magistrate making the decision.21 This had caused courts to deny search warrants for computers whose locations were unknown because they may have been outside the magistrate’s district.22 An amendment to the rule laid to rest this administrative hurdle by explicitly permitting magistrates to issue a search warrant for a device if the device’s location “has been concealed through technological means.”23 The relevant portion of Rule 41(b)(6) reads: 18. See What Is Malware?, PALO ALTO NETWORKS, https://www.paloaltonetworks.com/documentation/glossary/what-is-malware (last visited Apr. 4, 2017) (defining “malware” as “a file or code, typically delivered over a network[,] that infects, explores, steals or conducts virtually any behavior an attacker wants”); see also Steven M. Bellovin et al., Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet, 12 NW. J. TECH. & INTELL. PROP. 1, 26-27 (2014) (providing a brief technical explanation of how malware can control devices and components of a computer by modifying programs known as “device drivers”); Craig Timberg & Ellen Nakashima, FBI’s Search for ‘Mo,’ Suspect in Bomb Threats, Highlights Use of Malware for Surveillance, WASH. POST (Dec. 6, 2013), https://wpo.st/dooc2 (describing the functional- ity of various types of malware known to have been used by the FBI). 19. See In re Warrant to Search a Target Comput. at Premises Unknown, 958 F. Supp. 2d 753, 755 (S.D. Tex. 2013) (rejecting an application for a warrant to deploy malware “designed not only to extract certain stored electronic records but also to generate user photographs and location information over a 30 day period”); Timberg & Nakashima, supra note 18 (describing malware that turns on a computer’s camera); Kim Zetter, So . . . Now the Government Wants to Hack Cybercrime Victims, WIRED (May 4, 2016, 7:00 AM), https://www.wired.com/2016/05/now-government-wants-hack-cybercrime -victims (describing malware that turns on a computer’s microphone). 20. See Kevin Poulsen, Visit the Wrong Website, and the FBI Could End Up in Your Computer, WIRED (Aug. 5, 2014, 6:30 AM), http://www.wired.com/2014/08/operation_torpedo. 21. See FED. R. CRIM. P. 41(b)(1)-(5). Rule 41 provides that a search warrant may be issued by “a magistrate judge with authority in the district.” See id. 41(b). 22. See, e.g., In re Warrant to Search a Target Comput. at Premises Unknown, 958 F. Supp. 2d at 757, 761. 23. See Letters from Chief Justice John G. Roberts to Paul D. Ryan, Speaker, U.S. House of Representatives, and Joseph R. Biden, Jr., President, U.S. Senate, attachment at 6 (Apr. 28, 2016), https://www.supremecourt.gov/orders/courtorders/frcr16_mj80.pdf (submitting amendments to the Federal Rules of Criminal Procedure). Searching Places Unknown 69 STAN. L. REV. 1075 (2017) 1081 [A] magistrate judge with authority in any district where activities related to a crime may have occurred has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if: (A) the district where the media or information is located has been concealed through technological means . . . .24 Although the U.S. Department of Justice (DOJ), in recommending the amendment to Rule 41, explicitly stated that the amendment is not meant to give courts the power to issue warrants that authorize searches in foreign countries,25 the practical reality of the underlying technology means overseas searches will be both unavoidable and frequent. The result may well be the largest expansion of extraterritorial enforcement jurisdiction in FBI history.26 The legal process for network investigative techniques presumes search targets are territorially located, which is not at all accurate. Indeed, most potential targets on the dark web are outside the territorial United States.27 Approximately 80\% of the computers on the dark web are located outside the United States.28 And because each device’s location is indistinguishable from that of the next, any given law enforcement target is likely to be located 24. FED. R. CRIM. P. 41(b)(6) (emphasis added). The amendment became effective on December 1, 2016. See id. advisory committee’s note to 2016 amendment. 25. See Letter from Mythili Raman, Acting Assistant Att’y Gen., Criminal Div., U.S. Dep’t of Justice, to Judge Reena Raggi, Chair, Advisory Comm. on Rules of Criminal Procedure 4 (Sept. 18, 2013), in ADVISORY COMM. ON CRIMINAL RULES, ADVISORY COMMITTEE ON RULES OF CRIMINAL PROCEDURE: APRIL 2014, at 171, 174 (2014), http://www.uscourts.gov/sites/default/files/fr_import/CR2014-04.pdf. 26. See Ahmed Ghappour, Justice Department Proposal Would Massively Expand FBI Extraterritorial Surveillance, JUST SECURITY (Sept. 16, 2014, 9:10 AM), http://justsecurity .org/15018/justice-department-proposal-massive-expand-fbi-extraterritorial -surveillance. 27. For example, in the Silk Road case, computer security experts who were following or associated with the case opined that it was possible the FBI hacked into Silk Road servers, located in Iceland, to extract key evidence used in the prosecution and forfeiture proceedings. See, e.g., Joseph Cox, How Did the FBI Find the Silk Road Servers, Anyway?, MOTHERBOARD (Oct. 3, 2014, 8:55 AM), http://motherboard.vice.com/ read/how-did-the-fbi-find-the-silk-road-servers-anyway. This issue was raised by the defense and denied on standing grounds and is currently on appeal. See Brief for Defendant-Appellant at 108, United States v. Ulbricht, No. 15-1815-CR (2d Cir. Jan. 12, 2016), 2016 WL 158389; see also Andy Greenberg, Fed’s Silk Road Investigation Broke Privacy Laws, Defendant Tells Court, WIRED (Aug. 2, 2014, 2:54 PM), https://www.wired .com/2014/08/feds-silk-road-investigation-violated-privacy-law-sites-alleged-creator -tells-court. More recently, as part of a child pornography investigation the FBI infected thousands of computers overseas with malware. See Joseph Cox, FBI Hacked Over 8,000 Computers in 120 Countries Based on One Warrant, MOTHERBOARD (Nov. 22, 2016, 6:18 PM EST) [hereinafter Cox, FBI Hack], http://motherboard.vice.com/read/fbi -hacked-over-8000-computers-in-120-countries-based-on-one-warrant. 28. See Top-10 Countries by Relay Users, TORMETRICS, https://metrics.torproject.org/userstats-relay-table.html (last visited Apr. 4, 2017). Searching Places Unknown 69 STAN. L. REV. 1075 (2017) 1082 abroad. Thus, the issue is not whether magistrates should be authorized to issue search warrants where the target of the search can be in any of the ninety-four federal judicial districts in the United States. Instead, the issue is whether (and how) investigators should conduct out-of-district searches where targets are likely to be located out-of-country as well. The extraterritorial aspect of law enforcement hacking operations has drawn sharp public criticism by a wide array of commentators, academics, civil liberties organizations, and technology corporations.29 Technology giant Google warned that the use of network investigative techniques in pursuit of targets on the dark web would undermine the sovereignty of nations by “authorizing the government to conduct searches outside the United States.” 30 Google and others cautioned that loosening territorial restrictions on the government’s search and seizure power “raises a number of monumental and highly complex constitutional, legal, and geopolitical concerns.”31 While the Advisory Committee on Rules of Criminal Procedure flagged this concern,32 noting the potential regulatory gap regarding cross-border searches, it explicitly left such “issues that may have foreign policy implications” to be dealt with through “inter-executive branch coordination.”33 Whether law enforcement is permitted to launch cross-border cyberexfil- tration operations is the latest in a series of questions testing the limits of unilateral investigatory activities in a globally networked world. At the core of the inquiry is the well-established international law axiom that one state may 29. The Rule 41 Subcommittee received more than fifty written comments in addition to comments that were presented at hearings before the full Advisory Committee in November 2014. See Proposed Amendments to the Federal Rules of Criminal Procedure, REGULATIONS.GOV, https://www.regulations.gov/docketBrowser?rpp=25&so=DESC& sb=commentDueDate&po=0&D=USC-RULES-CR-2014-0004 (last visited Apr. 4, 2017). Civil liberties groups that submitted public comments included the ACLU, the Center for Democracy & Technology, the Electronic Frontier Foundation, the Electronic Privacy Information Center, and the National Association of Criminal Defense Lawyers. See id. 30. Letter from Richard Salgado, Dir. of Law Enf’t & Info. Sec., Google Inc., to the Advisory Comm. on Rules of Criminal Procedure 2-3 (Feb. 13, 2015), https://www.regulations .gov/contentStreamer?documentId=USC-RULES-CR-2014-0004-0029&attachment Number=1&contentType=pdf. 31. Id. at 1; see also, e.g., Ctr. for Democracy & Tech., Written Statement of the Center for Democracy & Technology Before the Advisory Committee on Rules of Criminal Procedure 4 (2014), http://www.regulations.gov/#!documentDetail;D=USC-RULES -CR-2014-0004-0009 (“Unilateral extraterritorial searches may violate the international obligations of the United States.”). 32. See Memorandum from Sara Sun Beale & Nancy King, Reporters, to Advisory Comm. on Rules of Criminal Procedure 13-14 (Feb. 25, 2015), in ADVISORY COMM. ON CRIMINAL RULES, ADVISORY COMMITTEE ON RULES OF CRIMINAL PROCEDURE: MAY 2015, at 87, 99- 100 (2015), http://www.uscourts.gov/sites/default/files/fr_import/CR2015-05.pdf. 33. Id. at 14-15. Searching Places Unknown 69 STAN. L. REV. 1075 (2017) 1083 not unilaterally exercise its law enforcement functions in the territory of another state,34 which has not been adequately addressed by courts or scholarship in the context of cyberspace. While there is a wealth of scholarship on the relationship between the Internet and state sovereignty, its focus has almost exclusively been on the permissibility of one state’s laws regulating Internet conduct that takes place in another state (exercising “prescriptive jurisdiction”), rather than the permissibility of a state effectuating compliance with those laws in the territory of another state (exercising “enforcement jurisdiction”).35 Jack Goldsmith offers perhaps the most sustained focus on the issue of cross-border enforcement jurisdiction. He argues that while multiple nations may in theory regulate the same Internet transaction, the system as a whole is stable in part because each nation can only enforce regulations within its territory.36 Thus, while states may criminalize conduct that occurs wholly outside their borders,37 the system as a whole is stable because states do not directly exercise law enforcement functions in other countries without first obtaining consent.38 In a similar vein, scholarship interrogating the extraterritorial aspects of law enforcement surveillance on the Internet has focused on the extraterritori- 34. See, e.g., RESTATEMENT (THIRD) OF THE FOREIGN RELATIONS LAW OF THE UNITED STATES § 432(2) (AM. LAW INST. 1987) (“A state’s law enforcement officers may exercise their functions in the territory of another state only … 250 word annotated bibliography apa format